EU opinion on legitimate interests of a data controller
23 May 2014
On 9 April 2014 the Article 29 Data Protection Working Party (the Working Party) adopted Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC.
This Opinion is important because one of the exemptions under the said Directive to obtaining consent to the processing of personal data is that of "legitimate interest".
Although many businesses rely on consent as the main mechanism for fair and lawful processing of personal data it must be remembered that the notion of legitimate interests is a valuable remedy, particularly where consent is unobtainable or impractical.
The Opinion includes many useful examples to help businesses assess whether or not the legitimate interest is valid right to allow processing of personal data without consent as well as helping businesses to understand that even legitimate interests must not outweigh the fundamental rights of a data subject and their reasonable expectations about what will happen to their personal data.
Additional advice in the Opinion is that the legitimate interest exception can be further validated where a data controller produces additional safeguards to protect personal data such as data minimisation, privacy/enhancing technologies, transparent privacy policies and a general and unconditional right to opt-out.
This article was written by Robert Bond.
For more information contact Robert on +44 (0)20 7427 6660 or email@example.com